==================================================================
BUG: KCSAN: data-race in __io_cqring_fill_event / io_drain_req

write to 0xffff88812ea25c00 of 4 bytes by task 6896 on cpu 0:
 io_get_cqe fs/io_uring.c:1583 [inline]
 __io_cqring_fill_event+0xfb/0x350 fs/io_uring.c:1767
 io_req_complete_post+0x4d/0x640 fs/io_uring.c:1790
 io_issue_sqe+0x6145/0x67b0
 io_wq_submit_work+0xf5/0x2c0 fs/io_uring.c:6803
 io_worker_handle_work+0x788/0xa20 fs/io-wq.c:515
 io_wqe_worker+0x1b9/0x540 fs/io-wq.c:566
 ret_from_fork+0x1f/0x30

read to 0xffff88812ea25c00 of 4 bytes by task 6893 on cpu 1:
 req_need_defer fs/io_uring.c:1343 [inline]
 io_drain_req+0x4c1/0x610 fs/io_uring.c:6525
 io_queue_sqe fs/io_uring.c:7007 [inline]
 io_submit_sqe+0x357e/0x3eb0 fs/io_uring.c:7187
 io_submit_sqes+0x505/0xde0 fs/io_uring.c:7293
 __do_sys_io_uring_enter fs/io_uring.c:9986 [inline]
 __se_sys_io_uring_enter+0x20d/0xb30 fs/io_uring.c:9928
 __x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:9928
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000000 -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 6893 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 6893 Comm: syz-executor.3 Not tainted 5.15.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd6/0x122 lib/dump_stack.c:106
 dump_stack+0x11/0x1b lib/dump_stack.c:113
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail+0x23c/0x250 lib/fault-inject.c:146
 __should_failslab+0x81/0x90 mm/failslab.c:33
 should_failslab+0x5/0x20 mm/slab_common.c:1328
 slab_pre_alloc_hook mm/slab.h:494 [inline]
 slab_alloc mm/slab.c:3306 [inline]
 kmem_cache_alloc_trace+0x52/0x320 mm/slab.c:3573
 kmalloc include/linux/slab.h:591 [inline]
 io_drain_req+0x30c/0x610 fs/io_uring.c:6532
 io_queue_sqe fs/io_uring.c:7007 [inline]
 io_submit_sqe+0x357e/0x3eb0 fs/io_uring.c:7187
 io_submit_sqes+0x505/0xde0 fs/io_uring.c:7293
 __do_sys_io_uring_enter fs/io_uring.c:9986 [inline]
 __se_sys_io_uring_enter+0x20d/0xb30 fs/io_uring.c:9928
 __x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:9928
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fc02cad5a39
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc02a84c188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 00007fc02cbd8f60 RCX: 00007fc02cad5a39
RDX: 0000000000000000 RSI: 00000000000045f5 RDI: 0000000000000003
RBP: 00007fc02a84c1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffc4f71b56f R14: 00007fc02a84c300 R15: 0000000000022000